MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 39758b8ddcb91ee136b9e73307ec8e8d7dc9f2680972ee0a79050722e28b055b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Amadey

Vendor detections: 14

Intelligence 14 IOCs YARA 5 File information Comments

SHA256 hash:	39758b8ddcb91ee136b9e73307ec8e8d7dc9f2680972ee0a79050722e28b055b
SHA3-384 hash:	6376fd34dd5ded3da2e2dcd9b663f5e7aab1280b4e6710f67592f1441b310afccaeca19b8a3fa854ef1c26b93232085b
SHA1 hash:	9c44bb29ed0be6e8eca1a2ca6f46f348c9f38e7e
MD5 hash:	04be93738192adabbdcd46d76b3848d7
humanhash:	spaghetti-princess-pluto-jupiter
File name:	random.exe
Download:	download sample
Signature	Amadey Create hunting rule
File size:	1'896'448 bytes
First seen:	2025-04-03 15:52:42 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	2eabe9054cad5152567f0699947a2c5b (2'861 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep	24576:B5Ie8Zjvbu0BHF/+wxa1NpwQ2Ko0lAyqNCEDLWKtHWxj0H1jNWruuIzwnKJ3ALAj:Pktnx2NgK9hqNC4LFsy1I5cw+ALACS6
TLSH	T10D95338B24AF3523C3A079B226B91E1335DC84188C8AFD24DF3C57A91E4F9D1F529976
TrID	29.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 22.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 20.3% (.EXE) Win32 Executable (generic) (4504/4/1) 9.1% (.EXE) OS/2 Executable (generic) (2029/13) 9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	abuse_ch
Tags:	Amadey exe

Intelligence

File Origin

# of uploads :

# of downloads :

187

Origin country :

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/349/

Detection(s):

SecuriteInfo.com.Trojan.Lumma-1.UNOFFICIAL

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67eeb11ccfd0a37f830d50e8

Tags:

vmdetect autorun

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Searching for analyzing tools

Searching for the window

Creating a file

Creating a window

Searching for synchronization primitives

Creating a file in the %temp% subdirectories

Creating a process from a recently created file

Creating a process with a hidden window

Connection attempt to an infection source

Enabling autorun by creating a file

Sending an HTTP POST request to an infection source

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

anti-vm microsoft_visual_cc packed packed packer_detected

Link:

https://www.filescan.io/uploads/67eeaef3b070fb3f945e53c0/reports/ba997343-c7c5-42ef-acb8-ddd72dc2332d/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/39758b8ddcb91ee136b9e73307ec8e8d7dc9f2680972ee0a79050722e28b055b

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/e2a9f669-0ff2-41fa-97aa-b2fe5ba41d21

Result

Threat name:

Amadey

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1655820

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to start a terminal service

Detected unpacking (changes PE section rights)

Found malware configuration

Hides threads from debuggers

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Potentially malicious time measurement code found

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Yara detected Amadey

Yara detected Amadeys Clipper DLL

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/39758b8ddcb91ee136b9e73307ec8e8d7dc9f2680972ee0a79050722e28b055b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/39758b8ddcb91ee136b9e73307ec8e8d7dc9f2680972ee0a79050722e28b055b/

Threat name:

Win32.Trojan.LummaStealer

Status:

Malicious

First seen:

2025-04-03 15:53:25 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

17 of 24 (70.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hf2yxdo4xepocnvz44zqp3eorv64t4tibfzo4ctzaudsfyulavnq._file

Result

Malware family:

xmrig

Score:

10/10

Tags:

family:amadey family:gcleaner family:lumma family:quasar family:stormkitty family:xmrig botnet:092155 botnet:office04 collection defense_evasion discovery execution exploit loader miner persistence privilege_escalation spyware stealer trojan upx

Link:

https://tria.ge/reports/250403-tbsyka1nt5/

Behaviour

outlook_win_path

outlook_office_path

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: LoadsDriver

Suspicious behavior: EnumeratesProcesses

Scheduled Task/Job: Scheduled Task

Modifies data under HKEY_USERS

Delays execution with timeout.exe

Checks processor information in registry

System Network Configuration Discovery: Wi-Fi Discovery

System Location Discovery: System Language Discovery

Program crash

Event Triggered Execution: Netsh Helper DLL

Enumerates physical storage devices

Browser Information Discovery

Launches sc.exe

Drops file in Windows directory

Drops file in Program Files directory

UPX packed file

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in System32 directory

Power Settings

Looks up external IP address via web service

Checks installed software on the system

Accesses Microsoft Outlook profiles

Modifies file permissions

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Unexpected DNS network traffic destination

Identifies Wine through registry keys

Executes dropped EXE

Checks computer location settings

Checks BIOS information in registry

Stops running service(s)

Possible privilege escalation attempt

Drops file in Drivers directory

Downloads MZ/PE file

Creates new service(s)

Command and Scripting Interpreter: PowerShell

XMRig Miner payload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Creates a large amount of network flows

Contacts a large (8930) amount of remote hosts

xmrig

Xmrig family

Stormkitty family

StormKitty payload

StormKitty

Quasar payload

Quasar family

Quasar RAT

Modifies security service

Lumma family

Lumma Stealer, LummaC

Gcleaner family

GCleaner

Amadey family

Amadey

Malware Config

C2 Extraction:

http://176.113.115.6
https://tacticaltalks.live/glKShay
https://metalsyo.digital/opsa
https://iironloxp.live/aksdd
https://navstarx.shop/FoaJSi
https://starcloc.bet/GOksAo
https://advennture.top/GKsiio
https://targett.top/dsANGt
https://spacedbv.world/EKdlsk
https://galxnetb.today/GsuIAo
https://xrfxcaseq.live/gspaz
https://jrxsafer.top/shpaoz
https://krxspint.digital/kendwz
https://rhxhube.run/pogrs
https://6grxeasyw.digital/xxepw
https://ywmedici.top/noagis
https://ironloxp.live/aksdd
https://gspacedbv.world/EKdlsk
https://1galxnetb.today/GsuIAo
185.156.73.98
45.91.200.135
goku92ad.zapto.org:5000

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/382e3f98-7ddd-43f3-bd7f-2bf51fd0b694

Unpacked files

SH256 hash:

39758b8ddcb91ee136b9e73307ec8e8d7dc9f2680972ee0a79050722e28b055b

MD5 hash:

04be93738192adabbdcd46d76b3848d7

SHA1 hash:

9c44bb29ed0be6e8eca1a2ca6f46f348c9f38e7e

Link:

https://www.unpac.me/results/d0b83356-5691-45f8-98d8-a65860ae8a49/

SH256 hash:

eb07ccf7db88d05a017b997348f29c029d83c08d06e1574da8f427c4d681d9dd

MD5 hash:

4340c883c92fd0d306d0cc957cc0951e

SHA1 hash:

fbf905390d5599b5a64b5d1a70955ccb7c28462c

Detections:

Amadey

Link:

https://www.unpac.me/results/d0b83356-5691-45f8-98d8-a65860ae8a49/

Malware family:

Amadey

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/39758b8ddcb9/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/39758b8ddcb91ee136b9e73307ec8e8d7dc9f2680972ee0a79050722e28b055b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/349/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample